cbcvebase.
CVE-2019-12274
published 2019-06-06

CVE-2019-12274: In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver…

PriorityP346high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.14%
62.7th percentile
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

Affected

5 ranges
VendorProductVersion rangeFixed in
github.comrancher_rancher>= 0 < 1.6.271.6.27
github.comrancher_rancher>= 2.0.0 < 2.2.42.2.4
github.comrancher_rancher>= 2.0.0+incompatible < 2.2.4+incompatible2.2.4+incompatible
suserancher1.0.0 – 1.6.28
suserancher2.0.0 – 2.2.3

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.